ADR-011: Accepted Both halves are in: the relocation strategy layer and the install pipeline that calls it. The record matches what shipped, including the consequences a live audit added.
ADR-011: staging on the destination volume, and a finite budget that clears a real archive Records three consequences a live audit produced: the working directories live under the staging tree so no rename crosses a volume; the solid-block default is above a real Qt archive's largest block and --memory-budget moves it; and plan and a dry run run the capability check rather than showing a green plan for a refused version.
ADR-011: the filesystem failure code, next to the unsupported one Decision 1 now states both codes where it states both outcomes: an unsupported target is relocate.unsupported_target (exit 7), a mid-relocation filesystem failure is relocate.failed (exit 6). A phase prefix and an exit number need not agree, as usage.insecure_scheme at exit 8 already shows.
ADR-011: pin the .prl and -F sentinels The .prl sentinel is the build prefix's lib directory, because $$[QT_INSTALL_LIBS] stands for <prefix>/lib; and the mac -F flag names lib, not the tree root. Records that a relocation filesystem failure is a filesystem outcome (exit 6), distinct from an unsupported target (exit 7).
ADR-011: relocating an installation, and installing it Records the Relocator contract and the ordered selector, the pre-download capability check, the text-layer primitives and the rule that nothing written may carry the install path, the atomic publish with a refused destination unless --overwrite, the manifest without absolute paths, and that --dry-run is the plan command itself.
ADR-010: accepted Planning an installation: selection by package name and architecture with the dependency fields deliberately not followed, the archive URL and destination rules, the plan'"'"'s shape and order, and "not found" as the failure for a plan that cannot be built. Its implementing change is internal/catalog and plan install-qt. Status moves from Proposed; the index follows.
ADR-010: name the module forms left out, and the suggestion Decision 6 records what the module candidate list is missing and why -- the Qt 6.8+ spellings, the basic-prefix form, and the "all" keyword -- so a module the reference tool resolves being refused here is an open difference rather than a hidden one. Decision 5 now matches the code: the ambiguous-architecture failure carries a suggestion, not only a message.
ADR-001: InstallPath is the Extract destination or the root Corrects the field description: a package without an Extract operation extracts at the install root, because its archive carries the version and architecture inside itself, so there is no derived, conventional value (ADR-010 decision 3). Records the SHA1 rename too, both amendments in one note.
ADR-010: planning an installation, and an ADR-009 amendment ADR-010 fixes how a request becomes a list of archives: selection by package name and architecture with the dependency fields deliberately not followed, the archive URL rule, the destination rule (per package, from Extract, and the root when there is none), the plan's shape and order, and "not found" as the failure for a plan that cannot be built. It corrects an earlier note: a package without Extract extracts to the install root, because its archive carries the version and architecture inside itself. ADR-009 gains decision 7 (identity positional, modifiers as options) and decision 8 (an option keeps the reference tool's name, so the install directory flag is -O/--outputdir). The first cut of list-qt had made host and target options against the plan's own section 11; the amendment moves it back.
ADR-009: accepted The shape it fixes is the one that shipped: the standard library, the tree as the whole vocabulary, the two ways an option's value is written, and the service seam a command reaches no further than. Its implementing change is list-qt, the first business command. Status moves from Proposed; the index follows.
Home: drop the note that the CLI record is still owed ADR-009 exists and is listed in the table, so the paragraph saying a record is still owed for the command line contradicted the table above it.
ADR-009: say how a listing renders a version A list-qt document carries versions as numbers ("5.15.2"), not as the repository's raw tokens ("5152"), which is why the payload is built from Dotted() rather than by marshalling model.Version. Records the split so it is not later "fixed" into Raw, and notes that ADR-001 section 1's rule for a marshalled version is unchanged.
ADR-009: the command line's shape and its parser The front end was written before the record: the tree is data, the grammar is confined to parse.go/options.go, and the plan has carried "a record is still owed" since. It is owed now that list-qt is the first business command. Records the standard library, the tree as the whole vocabulary, the two ways an option's value is written, and the service seam a command reaches no further than.
ADR-008: accepted Finding a version in the repository: probe an ordered list of observed layouts and never branch on a version; Updates.xml is authoritative; architectures come from the listing; a page is a listing only if it says so; and the segment is an observed entry too. The order is by what the version directory listing shows, which is what makes the three captured fixtures the probe's table.
ADR-007: cover the trusted-base fallback, and say what is not verified Decision 3 now says the no-cross-host rule also covers a trusted base's own digest, since that base is the root of trust once its digest is accepted. The consequences note that a listing or Updates.xml is not checksum-verified: the digest proves an archive's bytes, and no unverified bytes can land.
ADR-007: accepted The download policy is settled: HTTPS only, mirrors named on the command line in order, the digest served by the official endpoint and never by the mirror, and trust placed in content rather than in hosts. Status moves from Proposed; the implementing changes are the archive digest field and the transport that follows.
ADR-007: transport security and mirror trust (Proposed) Records the download policy as a decision: HTTPS only, mirrors named on the command line in order, the digest served by the official endpoint and never by the mirror, and trust placed in content rather than in hosts -- which is what removes the allowlist. Also amends ADR-001 section 4: Archive.SHA256 becomes SHA1, because SHA-1 is what the metadata declares, while the verified SHA-256 is the transport's. The wiki copy is updated with the change so the amendment is not one-way.
ADR-006: accepted Its implementing changes are in: the build driver, the pinned C toolchain and its floor, the on-demand floor check, and build -cc. Status moves from Proposed, and the index follows.
ADR-006: a build can name its own compiler, and the C flags Decision 3 gains build -cc for a distribution packaging qtogo; the platform rules, the glibc target above all, describe zig and are skipped for a compiler we did not choose. Records that the C is compiled at cgo's own -O2 -g default and that the release linker args strip the debug info, so the -g reaches no shipped binary.
ADR-006: qualify the exit-status promise The driver exits with the status of the tool it ran, but only when it is the process that runs; invoked as go run ./bootstrap, go run reports its own status instead.
ADR-006: the floor check is a gate, not a per-commit tax
ADR-006: name the reason the floor is inert in the consequence too
ADR-006: say what actually makes the Linux binary portable Not the floor and not the compiler: the same sources built with the system gcc are byte-identical, both static because nothing in the cgo objects references a libc symbol. The floor bounds what the C side may require and becomes load-bearing if that changes.
ADR-006: the glibc floor is a bound, not what makes the binary portable Measured rather than assumed: the linker produces a static binary, so it needs no glibc at all and starts below the floor. The floor bounds what the C side may require and becomes load-bearing if the linking changes, so CI checks both the requirement and the floor.
Add ADR-006: building and testing The build driver, the pinned C toolchain and the manual release say what a build promises about the machine it runs on, which is a decision rather than mechanics.
ADR-005: accepted Its implementing changes are in: the extraction policy layer and the tightening of the symlink target rule. Status moves from Proposed, and the index follows.
ADR-004: the minor bound is a maintained constraint Records why it exists rather than only what it is: reading a directory identifier is best-effort, upstream publishes no rule for it and documents its own positional reading as an assumption, so an ambiguous identifier is refused rather than guessed. Also records that the bound is this project's to keep current, that confirming a version from the metadata is the future way out of that upkeep, and that the encoder is not the reader read backwards.
ADR-004: decision 5 bounds a decoded minor A token's digits often admit two splits and structure cannot separate them, so a candidate version is now validated against a per-major numeric bound derived from the repository corpus. The bound constrains what the naming scheme encodes, not which versions exist; the patch stays unbounded.
ADR-005: the link target rule is now in force Drop the note that said the rule was decided but not yet applied: the change that applies it is open, so the record reads as what the code does.
Correct ADR-004, ADR-005 and one sentence of ADR-002 ADR-004: move the corpus counts, probe method and live-page checks to the repository's docs/research/version-directory-corpus.md, leaving the record the decision; state the decoder rule as "accept only the shapes the corpus shows", so an ambiguous token like qt6_6810 is refused rather than read as 6.81.0. ADR-005: hold a symlink target to the same rule as a name -- a plain relative path -- rather than resolving it and refusing only an escaping one, which would accept two spellings for one location. All three: state requirements rather than the author's intent.